Approved changes feed: RSS · Atom
cpe:2.3:a:openmicroscopy:omero-web:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Openmicroscopy (645fa6f0-9d90-56fe-a9a7-7c01ea4b3691) |
|---|---|
| Product | Omero Web (de3fab11-1424-5785-8af4-d935438891ed) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/ome/omero-web |
purl2cpe | 2026-06-01 10:17:44.324212 |
pkg:pypi/omero-web |
purl2cpe | 2026-06-01 10:17:44.324215 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-54791 |
vulnerable | 2026-06-08 07:33:13.221581 |
OMERO.web displays unecessary user information when requesting to reset the password
MEDIUM (5.3)
OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. This issue has been patched in version 5.29.2. A workaround involves disabling the Forgot password option in OMERO.web using the omero.web.show_forgot_password configuration property.
Published: 2025-08-13T14:08:19.607Z
Updated: 2025-08-13T14:25:28.402Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-35180 |
vulnerable | 2026-06-08 06:37:35.391852 |
OMERO.web JSONP callback vulnerability
MEDIUM (6.1)
OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.
Published: 2024-05-21T12:33:02.639Z
Updated: 2024-08-02T03:07:46.755Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-41132 |
vulnerable | 2026-06-08 05:35:19.800513 |
Inconsistent input sanitisation leads to XSS vectors
CRITICAL (9.8)
OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.
Published: 2021-10-14T15:45:12.000Z
Updated: 2024-08-04T02:59:31.416Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.